Repository navigation
Conversation
…isor # Conflicts: # scripts/check-native-env-plan-cli.ts
…isor # Conflicts: # scripts/check-native-env-plan-cli.ts
Freeze the guard before removing it and prove it has not begun its own escalation and that the TERM-ignoring child is still live, so only the stop's admission snapshot can KILL the child. Require a fresh five-second recovery grace after guard loss. Align the documented model summary with the maintained 426-state coverage. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Status at |
…isor # Conflicts: # docs/reference/v5-model-coverage.md # scripts/lib/tla-runtime-models.ts
…or-stop-followups
…on a sibling Every guard took a blocking flock on the shared lifecycle.log around each record. A guard stopped (SIGSTOP, a debugger, a hung write) while holding it stalled every sibling guard's loop in flock: no output, no exit detection, no stop handling. Captured on macOS as the 9/100 failure of expired_target_does_not_abandon_other_recovery (worker guard blocked in Lines::flush -> flock while the frozen blocked guard held the lock). Each record is now one write on the O_APPEND descriptor with no lock. The kernel places each append atomically, so whole records from different guards never interleave on a local file system; only a short write (for example a full disk) can split one. The unused flock retry helper and its unit test are removed. Regressions: held_log_lock_never_stalls_a_guard holds the log flock from outside for the whole run and requires output to reach the log and stop to answer stopped within the normal bound (fails with the old lock); concurrent_guards_append_whole_records_without_a_lock checks two guards bursting 64 KiB records leave only whole, unmixed records. Docs state the log's ordering and integrity and list every lock, who can hold it across a blocking call, and the bound. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…hort-write causes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…or-stop-followups
…isor-stop-followups # Conflicts: # docs/lifecycle-supervisor.md # packages/lifecycle-supervisor/src/os.rs # packages/lifecycle-supervisor/src/supervisor.rs # packages/lifecycle-supervisor/tests/fake_caller.rs
…echeck Linux identities Round-4 finding 4: one receipt of the owner that could not be verified (guard gone, no witness for its session) returned from stop admission before any target was signalled, so healthy commands of the same owner kept running. Admission now records that failure and skips only that receipt, which is never signalled; the other targets get their normal stop, and the reply is still unknown with stop-incomplete. Regression: unverifiable_receipt_does_not_block_healthy_targets (fails with the old abort). Round-5 finding 1 (Linux): a single listing of /proc/<pid>/task could read a process whose main thread exited as a zombie if every listed thread was replaced during the scan. "No live thread" now needs two consecutive listings to agree. inspect also re-reads the leader's start time after assembling an identity from stat, status and the task list, and repeats the reads if the PID was reused in between, instead of combining two processes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ument reply and log limits Round-5 and round-6 follow-ups (all non-blocking): - A foreign receipt whose live members no witness ties to it now answers foreign-unknown-process instead of io-error. Tests pin it and the foreign-live-process, stop-incomplete and retired-owner-live reasons; a refused_framed helper requires the frame for stop and status refusals. - concurrent_guards_append_whole_records_without_a_lock now starts both bursts from one start file, requires them to overlap, and checks every field including a 20-byte timestamp; splitting each record into two writes fails it. - Docs: the framed-reply guarantee covers requests whose frame is read, and lists the exits without a frame; reply process lists are a snapshot taken after the stop lock is released; readers hold back an unterminated last line; a failed log write can split a record and ends that guard's command (a file-size limit's SIGXFSZ ends the guard itself); a guard frozen before it detaches keeps run and stop failing within their bounds, with the recovery step; the retire-failed marker may remain; the lock table names the plan-write deadline, the rollback time and the signal stop as a waiter. - Comment fix (receipt-read-failed) and #[track_caller] on Fixture::request and Fixture::state. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…count Reviewer P1: two listings of /proc/<pid>/task still cannot prove a thread group dead under repeated thread turnover, because a listing never sees a thread created after it. A leader that shows Z now counts as dead only when the thread count on its own stat line (field 20, read in the same read as the state) is at most one. An exiting thread stays counted until released, which only errs toward live. The task scan is removed. Regression: main_thread_exit_with_live_worker_is_still_stopped also runs a pthread-churn fixture whose only worker keeps replacing itself, with and without guard loss; stop must signal it and the process must be gone. Reviewer P2: concurrent_guards_append_whole_records_without_a_lock now forces overlap with a barrier on the shared log (each writer waits until both halves are logged) and asserts overlap in both directions; splitting records into two writes still fails it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…at a fixed time Hosted Intel macOS failed orphan_recovery_waits_for_unobserved_descendant_to_exit: the fixture's late child lived a fixed six seconds from its own fork, which can land after the stop's seven-second deadline on a slow runner. The child now waits until its parent (the captured command) has been killed by recovery at five seconds, then exits 0.5 s later, well inside the deadline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reopen bound from the earlier fix could still run out under heavy contention: a reader that kept opening an inode the writer replaced before its fstat refused after 64 tries (4 of 24 runs of receipt_reads_survive_concurrent_atomic_replacement under parallel load). A read-only open now accepts an inode that was unlinked after the open: it is a complete receipt, the version current at the open, and an unlinked inode has no name a hard link could alias. Opens that may write still retry the name for its current inode. Extra hard links are still refused. Stress: 0 of 40 parallel runs fail (was 4 of 24). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…before fork Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Ready for lead: 4002381 Follow-up to #802: every open non-blocking finding from your rounds 4, 5 and 6, mapped one by one in the PR description. Base Since the description was written (all reviewer-checked):
Loop counts (recovery group What I ran at this head: fmt; Clippy with warnings denied on Linux, aarch64-apple-darwin and x86_64-apple-darwin; 13 unit and 57 fake-caller tests. At 87b9477 (repo files unchanged since): Review: the persistent Codex reviewer is CLEAN at this head, after findings on the task scan, the overlap test and the fixture's parent PID. I re-requested the Codex GitHub bot. Decisions for you:
For your Mac rerun: the same 100-run recovery-group loop. The crate changes are in #811 and #821 do not contain this PR's receipt-read fix; it reaches them through |
…isor-stop-followups # Conflicts: # docs/lifecycle-supervisor.md
|
@codex review |
|
Ready for lead: daa096f This head is a normal merge of Merge: #811 and #859 both changed the crate, so this was a real two-sided merge.
What I ran (Linux 6.8 x86_64):
Recovery-group loop at this head: 100/100 ( Status: The decisions (Q1 APFS, Q2 failed log write and SIGXFSZ, the group-signal race) are unchanged from the previous note. |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Follow-up to #802 (merged): the open non-blocking findings from the lead's review rounds 4, 5 and 6. Base
next. Each finding maps to a change below.Round 4
unknownimmediatelyRecovery::livereturnsCaptured,UnobservedorGone. Unobserved members are never signalled; stop waits until the target's own deadline for them, and reportsunknownonly if they are still aliveorphan_recovery_waits_for_unobserved_descendant_to_exitandorphan_recovery_never_signals_unobserved_descendant; both fail with an immediate error onUnobservedguard_lost_mid_stop_keeps_admission_snapshotdid not force the fallbackunknown/stop-incompleteunverifiable_receipt_does_not_block_healthy_targetsfails with the old abortRound 5
/proc/<pid>/tasklistings to agree.inspectre-reads the leader's start time after assembling an identity fromstat,statusand the task list, and repeats the reads if the PID was reused. No deterministic test: the window is complete thread turnover inside microsecondsprocesses,liveProcessNamesandunknownProcessNamesare a snapshot at reply time;outcome,reasonand the exit status describe the requestforeign-live-process,stop-incompleteandretired-owner-liveare asserted. Arefused_framedhelper requires the frame for stop and status refusalsforeign-unknown-process(wasio-error), with a test. Thereceipt-read-failedcomment is fixed. The doc notes theretire-failedmarker may remain.#[track_caller]onFixture::requestandFixture::stateRound 6
alpharecord after the firstbetarecord and checks every field, including a 20-byte timestamp. Mutation: writing each record in two pieces fails it (3 of 3)stoprecovers its command as after any lost guardrunandstopof the whole root failing, each within its bound, for as long as it is frozen. It also covers the failure-path hold, a guard with no receipt yet, and the recovery step (find the stopped guard, thenSIGCONTor kill it)Decisions for the lead
Validation (Linux 6.8 x86_64)
tests/machine-output-contract.test.ts,tests/sync-spawn-bound.test.tsandtests/tla-runtime-models.test.ts: 267 pass.check:native-plan-cliacceptance scripts.🤖 Generated with Claude Code